CVE-2026-73071
LowCVSS 3.3Summary
Vim, an open source text editor, has a vulnerability in json_decode_item() in src/json.c that can retain a stale pointer after json_decode_string() invokes channel_fill(), causing the error path to read freed memory when an invalid JSON string spans buffers. Affects versions from 9.2.0511 to 9.2.0844, fixed in 9.2.0844.
Risk Assessment
The risk includes potential read of freed memory, leading to unpredictable editor behavior or potential information leak.
Recommendation
Update Vim to version 9.2.0844 or later, which contains the fix.
Original NVD description (English source)
Vim is an open source, command line text editor. From 9.2.0511 until 9.2.0844, json_decode_item() in src/json.c can retain a stale pointer after json_decode_string() invokes channel_fill() to refill and free the current buffer, causing the error path to read freed memory instead of reader->js_buf + reader->js_used when an invalid JSON string spans buffers. This issue is fixed in version 9.2.0844.